Chinese-Cybercrime-Research

Chinese Cybercrime Research Resources to learn more about Chinese-language cybercrime actors. Phishing Phishing Kits YYlaiyu https://cloud.google.com/blog/topics/threat-intelligence/chinese-language-phishing-services https://spycloud.com/blog/yylaiyu-chinese-phishing-as-a-service-panel/...

nuclei

English • 中文 • Korean • Indonesia • Spanish • 日本語 • Portuguese • Türkçe...

C2-detection-manjusaka

Detecting the "Manjusaka" C2 framework Detecting the C2 framework Manjusaka: "A Chinese sibling of Sliver and Cobalt Strike" References: Detection logic details: https://corelight.com/blog/detecting-manjusaka-c2-framework Writeup by Talos:...

CVE-2021-26856

I have translated the chinese exploit at https://github.com/jsdryan/CVE-2021-26855 for english reader and people unfamiliar with golang just look at the png pictures...

CVE-2024-37051-EXP

CVE-2024-37051-EXP CVE-2024-37051 poc and exploit See PR 1: https://github.com/LeadroyaL/CVE-2024-37051-EXP/pull/1 Chinese vulnerability analysis: https://leadroyal.cn/p/2403/...

U.S. Agencies Accuse China AI Firms of Distilling Claude, GPT, Gemini, and Grok

U.S. cybersecurity and intelligence agencies have accused China-based artificial intelligence AI companies of conducting "systematic extraction" of proprietary functionalities and capabilities of American frontier models through distillation attacks. The activity has been described as occurring a...

Flash-player

Fake-flash.cn www.flash.cn 的钓鱼页，中文+英文 在线预览：http://fake-flash.se7ensec.cn/...

⚡ Weekly Recap: Chinese Spy Proxy, AI Agents Go Off-Task, Router Backdoors and More

The boring parts caused most of the trouble. A router shipped ready to listen. A fake check turned the user into the installer. Trusted systems collected traffic and passwords, then cleaned the logs. Old bugs formed new attack chains. Even an AI agent decided its assigned task was optional...

Chinese-Made Zbtlink Routers Ship With Backdoor That Opens Unauthenticated Root Shells

Cybersecurity researchers have disclosed details of a "factory-shipped backdoor" implanted in at least 20 Chinese router models from Zbtlink. According to a new report from VulnCheck, the implant appears in all 21 firmware images currently available from Zbtlink that span more than 2 years. The...

Chinese Threat Actor Uses Leaked DarkSword Kit to Deploy GHOSTBLADE on iOS

An unknown Chinese-speaking threat actor has been observed running a campaign targeting Apple iOS devices by leveraging a publicly leaked version of the DarkSword exploit kit. Attack surface management platform Censys said it identified the threat actor running more than 100 web properties, most ...

Suspected Chinese-Speaking Hackers Target Central Asian Governments With OctLurk and SilkLurk

A Chinese-speaking threat actor is suspected to be behind a fresh wave of cyber attacks targeting government organizations mainly located in Central Asia, including Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan, and the Syrian Arab Republic, since January 2025. These targeted...

Chinese Hacker Commands DeepSeek via Telegram to Launch Autonomous Attacks

Palo Alto Networks' Unit 42 says a Chinese-speaking threat actor used DeepSeek through the open-source Hermes Agent framework to launch attacks autonomously. After an initial Telegram instruction, the agent found internet-facing systems and selected public exploits. The researchers recovered no...

CVE-2026-64304

In the Linux kernel, the following vulnerability has been resolved: crypto: qat - validate RSA CRT component lengths The generic RSA key parser rsahelper.c bounds each CRT component p, q, dp, dq, qinv by the modulus size nsz, but qatrsasetkeycrt allocates half-size DMA buffers keysz / 2 and...

CVE-2026-13104

A potential vulnerability was reported in Lenovo App Store, distributed exclusively in the Chinese market, that could allow a local authenticated user to execute arbitrary code with elevated privileges...

EUVD-2026-44977

A potential vulnerability was reported in Lenovo App Store, distributed exclusively in the Chinese market, that could allow a local authenticated user to execute arbitrary code with elevated privileges...

CVE-2026-13103

A potential path traversal vulnerability was reported in Lenovo App Store, distributed exclusively in the Chinese market, that could allow a local authenticated user to execute arbitrary code...

EUVD-2026-44976

A potential path traversal vulnerability was reported in Lenovo App Store, distributed exclusively in the Chinese market, that could allow a local authenticated user to execute arbitrary code...

CVE-2026-9046

A potential insecure permissions vulnerability was reported in Legion Zone and the Lenovo App Store Windows applications, distributed exclusively in the Chinese market, that when installed on a non‑system partition, could allow a local user to execute arbitrary code...

CNVD-2023-27598

creationtimestamp| type| source ---|---|--- 2026-06-30 09:23:11+00:00| exploited| https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/d00febbd-741a-4af5-a5f6-82b4ca156c88...

Security Bulletin: XcodeGhost iOS malware

Question Security Bulletin: XcodeGhost iOS malware "Business Unit":"code":"BU059","label":"IBM Software w/o TPS","Product":"code":"SS8NDZ","label":"IBM Aspera","Component":"","Platform":"code":"PF025","label":"Platform Independent","Version":"All Versions","Edition":"","Line of...